Description
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | VMware ESXi | 7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG | — |
| — | VMware Cloud Foundation | 4.x before 4.2 and 3.x | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 7 repositories
-
Shadow0ps/CVE-2021-21974 ★ 188 · May 25, 2021
POC for CVE-2021-21974 VMWare ESXi RCE Exploit
-
Aiyakami/CVE-2021-21974 ★ 6 · Jul 8, 2026
自研针对ESXI 堆栈溢出的CVE-2021-21974 POC，只支持项目给出的的目标和环境，用于学习和研究
-
CYBERTHREATANALYSIS/ESXi-Ransomware-Scanner-mi ★ 2 · Feb 8, 2023
ESXi EZ - A custom scanner that takes list of IPs either in JSON, CSV or individually and checks for infection CVE-2021-21974
-
n2x4/Feb2023-CVE-2021-21974-OSINT ★ 2 · Feb 4, 2023
Analysis of the ransom demands from Shodan results
-
abirasecurity/CVE-2021-21974_vuln_dectection ★ 0 · Sep 4, 2025
CVE-2021-21974 Vulnerability Detection Tool Safe PoC that identifies vulnerable SLP implementations without exploitation
-
mercylessghost/CVE-2021-21974 ★ 0 · Jan 10, 2025
-
hateme021202/cve-2021-21974 ★ 0 · Oct 19, 2023
Nmap NSE script for cve-2021-21974
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.